A team is designing a pipeline for a Terraform repository. Reviewers must approve exactly the changes that will be applied, and syntax or formatting problems should fail early. Which stage order meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
Here's the golden rule: the plan you approve should be the plan you apply, not a fresh one cooked up later. Save it with -out and hand that exact file to apply. And put the cheap checks up front, so a formatting slip fails in seconds rather than after a long plan.
Full Explanation
terraform fmt -check needs no initialization and fails fast on non-canonical files. terraform init installs providers and modules and configures the backend, which validate needs in order to check provider schemas, so validate comes after init. terraform plan -out=tfplan saves the exact proposed actions to a file; reviewers approve that rendering, and terraform apply tfplan executes those actions without re-planning, so what was approved is what runs. Applying with -auto-approve and no plan file creates a new plan at apply time, which can differ from the reviewed one if infrastructure, inputs or upstream modules changed in between; it also runs validate before init, which fails because providers are not installed. Running formatting and validation after apply defeats their purpose as gates. Generating a second plan after approval means reviewers approved a different plan from the one applied. Exam caveat: a saved plan becomes stale if state changes before it is applied; Terraform refuses to apply a stale plan, and in Terraform 1.15 it also errors if a plan file is applied in a different workspace from the one it was created in. Operational check: confirm the apply job consumes the same plan artifact that the review job displayed.